Re: Zip 2,31 bad default file-permissions vulnerability
Quoting Imran Ghory <imranghory@xxxxxxxxx>:
> A zip file created by Zip 2.3.1 has the permissions 644 by default,
> Therefore any file compressed becomes world readable.
Zip 2.3 works correctly:
$ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
adding: feedlist.opml (deflated 80%)
-rw-rw-rw- 1 lupe lupe 3156 Aug 4 10:52 test.zip
$ (umask 077; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
adding: feedlist.opml (deflated 80%)
-rw------- 1 lupe lupe 3156 Aug 4 10:52 test.zip
HTH,
Lupe Christoph
--
| lupe@xxxxxxxxxxxxxxxxx | http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like |
| covering yourself with barbecue sauce and breaking into the Charity |
| Home for Badgers with Rabies. Michael Lucas |